In the above snippet we use the UserExists and GroupExists functions
that define a class for us depending on the result of the functions.

In other words if the user virtual exists on the system then for that
system the class user virtual is defined.

In the shellcommands section we define the actual command for creating
user and group, which will be executed on the systems from the
ftp_servers group for which the user_virtual class is not defined,
meaning that the user does not exists yet.

Removing users and groups

The above example for creating users can be modified this way, so that
now the user virtual and group sftp will be removed if they exist.

Managing multiple users/groups

The above examples show how to manage a single user/group, but having
more users/groups to manage at once can become tedious to have a
user_username = ( UserExists(username) ) for each user/group you
need to manage.

Instead we can make use of CFEngine’s lists.

The below example snippets show how to create a number of users and
groups. These examples can be extended further to remove, modify,
etc..